Function decryptConfig

pkg/config/loader.go:69–114

decryptConfig decrypts all encrypted fields in the config using the master key. Only prompts for the master password if encrypted content is detected.

(c *MainConfig)

// decryptConfig decrypts all encrypted fields in the config using the master key.
// Only prompts for the master password if encrypted content is detected.
func decryptConfig(c *MainConfig) error {
	hasEncrypted := false
	for _, pwd := range c.Main.Passwords {
		if utils.IsEncrypted(pwd) {
			hasEncrypted = true
			break
		}
	}
	if !hasEncrypted {
		for _, s := range c.ServerLists {
			if utils.IsEncrypted(s.Password) {
				hasEncrypted = true
				break
			}
		}
	}
	if !hasEncrypted {
		return nil
	}

	key, err := utils.GetMasterKey()
	if err != nil || key == nil {
		return fmt.Errorf("encrypted fields found but no master key provided")
	}

	for i, pwd := range c.Main.Passwords {
		if utils.IsEncrypted(pwd) {
			decrypted, err := utils.Decrypt(pwd, key)
			if err != nil {
				return fmt.Errorf("failed to decrypt password[%d]: %w", i, err)
			}
			c.Main.Passwords[i] = decrypted
		}
	}

	for i := range c.ServerLists {
		if utils.IsEncrypted(c.ServerLists[i].Password) {
			decrypted, err := utils.Decrypt(c.ServerLists[i].Password, key)
			if err != nil {
				return fmt.Errorf("failed to decrypt server cache password[%d]: %w", i, err)
			}
			c.ServerLists[i].Password = decrypted
		}
	}
	return nil
}

// encryptConfigForSave creates a copy with encrypted passwords for saving to disk.
// Uses the cached master key only — does not prompt interactively.